W3WP Launching Encoded Powershell

Google SecOps@GoogleSecOps

•updated Sep 29, 2025•1•0•4

Detects on the execution of an encoded powershell command with a parent process of w3wp.exe.